Kernel event ID 2 is logged when the MSFT_NetLbfoTeamNic class is called in Windows Server 2012 R2

Symptoms

When Windows Server 2012 R2 is used with the NIC Teaming feature, and a third-party WMI provider is used to call the MSFT_NetLbfoTeamNic WMI class, the following event is logged:

Source: Kernel-EventTracing/AdminEvent ID: 2Session "" failed to start with the following error: 0xC0000022

This article addresses only this specific error that occurs when NIC Teaming is being used. This error is not the fault of the third-party WMI provider. Additionally, this event may be logged for reasons that are not related to the NIC Teaming WMI provider.

Cause

This problem is not caused by the third-party WMI provider. This problem is being tracked for consideration in a future version of Windows Server.

The Windows Server 2012 R2 MSFT_NetLbfoTeamNic WMI class uses the iNetCfg interface. The iNetCfg interface is associated with the NetCfgTrace kernel logging provider, which is automatically enabled by Windows. Trace data is automatically saved to the C:\Windows\inf\netcfgx.0.etl file. All WMI providers run under the context of the WMIPRVSE process, which in turn runs under the NETWORK SERVICE account. However, if a WMI provider calls the MSFT_NetLbfoTeamNic class, the NETWORK SERVICE account does not have authority to write trace data to this file.

Workaround

If the scenario that's described in the "Symptoms" section triggers the kernel event ID 2 error, the error is harmless and can be safely ignored.

If you want to prevent this error from being logged, open an administrative command prompt, and then run the following commands: